Setting up a VPN on Android is quick, but the defaults leave two holes: the system will put the app to sleep in the background to save battery, and when the tunnel drops it will quietly send traffic out the normal way. Closing both takes three settings: Always-on VPN, Block connections without VPN, and Unrestricted in the app's battery options. Here is the install, those settings, Private DNS, split tunneling, and a check that it all works.

Option 1: the provider's app

  1. Install the app from Google Play or from the provider's own site. Not from APK mirrors.
  2. Sign in and tap connect. Android asks once for permission to set up a VPN connection; allow it.
  3. In the app's settings, turn on the kill switch and DNS leak protection if they are not on by default.
  4. Open What Is My IP: the address and country should be the server's.

Option 2: a WireGuard configuration

If the provider gives you a WireGuard file or QR code, install the official WireGuard app, tap +, scan the code or import the file, and flip the toggle. What each line of the config means, and when VLESS is the better protocol, is in WireGuard vs OpenVPN and what is VLESS.

The two system settings that make it airtight

Settings → Network & internet → VPN → gear icon next to your VPN app. Two toggles:

Always-on VPN. The system reconnects the tunnel after a reboot, a network change, and any drop. Without it, after a drop the VPN simply stays off.

Block connections without VPN. Until the tunnel is up, no app gets online. This is a system-level kill switch; it works even if the VPN app has crashed. The first toggle without the second does not protect you: between the drop and the reconnect, traffic goes out unprotected. Why that matters is in what is a VPN kill switch.

Side effect: the login page on public Wi-Fi (captive portal) cannot load while everything is blocked. Turn the block off for a minute, log in to the network, turn it back on.

Battery: why the VPN dies on Samsung and Xiaomi

Samsung, Xiaomi, Huawei, OnePlus and Oppo kill background apps aggressively. Symptom: the VPN works while you are using the phone; pick it up an hour later and it is off.

Settings → Apps → your VPN app → Battery → Unrestricted (or "Don't optimize"). On Xiaomi also enable Autostart; on Huawei, set the app to manual management under app launch. After this the tunnel survives the screen being off.

Private DNS and VPN

Android can encrypt DNS system-wide: Settings → Network & internet → Private DNS. But with a VPN running, a third-party Private DNS hostname sends queries outside the tunnel. While you use the VPN, set Private DNS to Off or Automatic and let the VPN app handle DNS. Check with the steps in is my DNS leaking.

Split tunneling

The VPN app usually lists installed apps with checkboxes. Banking apps that refuse to work through a VPN can be excluded while the browser and messengers stay inside. Excluded apps go out directly and are unprotected, so keep the list short and never exclude the browser. Details in what is split tunneling.

Check

  1. What Is My IP: server address, not yours.
  2. WebRTC leak test in the browser: real address not shown.
  3. IPv6 leak test: no local IPv6.
  4. Switch from Wi-Fi to mobile data: the key icon in the status bar should not disappear for more than a couple of seconds.
  5. Switch servers in the app while a page loads: the page should freeze until the tunnel is back, which proves the block works.

If something is wrong

  • Will not connect on a specific network (campus, office): the network blocks UDP; switch the protocol to VLESS or automatic. Causes and fixes in VPN not working on Wi-Fi.
  • Connected but sites do not load: DNS or IPv6; recheck steps 2 and 3 and the Private DNS setting.
  • Drops after a few minutes: battery, above, and why does my VPN keep disconnecting.

404 VPN's Android app uses VLESS or WireGuard with automatic selection, keeps DNS inside the tunnel, supports a kill switch and per-app split tunneling, and works with Always-on VPN. Get started here.